How severe is CVE-2024-45626?

CVE-2024-45626 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.

Is CVE-2024-45626 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-45626?

CVE-2024-45626 affects Apache James Server. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-45626?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.

Does CVE-2024-45626 have an EU (EUVD) identifier?

Yes. CVE-2024-45626 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4972.

When was CVE-2024-45626 published?

CVE-2024-45626 was published on 2025-02-06 and last updated on 2026-06-17.

CVE-2024-45626

CVE-2024-45626 is a medium-severity vulnerability in Apache James Server with a CVSS 3.x base score of 6.5. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-400.

Key facts

Severity: Medium (CVSS 3.x base score 6.5)
EPSS exploit prediction: 1% (51st percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2025-4972
Weakness: CWE-400
Affected product: Apache James Server
Published: 2025-02-06
Last modified: 2026-06-17

Description

Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.

Frequently asked questions

What is CVE-2024-45626?: Apache James server JMAP HTML to text plain implementation in versions below 3.8.2 and 3.7.6 is subject to unbounded memory consumption that can result in a denial of service. Users are recommended to upgrade to version 3.7.6 and 3.8.2, which fix this issue.
How severe is CVE-2024-45626?: CVE-2024-45626 has a CVSS 3.x base score of 6.5, rated medium severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is none, integrity none, and availability high.
Is CVE-2024-45626 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (51st percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-45626?: CVE-2024-45626 affects Apache James Server. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-45626?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
Does CVE-2024-45626 have an EU (EUVD) identifier?: Yes. CVE-2024-45626 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2025-4972.
When was CVE-2024-45626 published?: CVE-2024-45626 was published on 2025-02-06 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:apache:james_server:*:*:*:*:*:*:*:*

More vulnerabilities in Apache James Server

CVE-2024-37358 — High (CVSS 8.6): Similarly to CVE-2024-34055, Apache James is vulnerable to denial of service through the abuse of IMAP literals from…
CVE-2015-7611 — High (CVSS 8.1): Apache James Server 2.3.2, when configured with file-based user repositories, allows attackers to execute arbitrary…
CVE-2017-12628 — High (CVSS 7.8): The JMX server embedded in Apache James, also used by the command line client is exposed to a java de-serialization…

All CVEs affecting Apache James Server →

Other CWE-400 (Uncontrolled Resource Consumption) vulnerabilities

CVE-2026-46775 — Critical (CVSS 9.9): Vulnerability in Oracle REST Data Services (component: Core). Supported versions that are affected are 24.2.0-26.1.0.…
CVE-2025-61303 — Critical (CVSS 9.8): Hatching Triage Sandbox Windows 10 build 2004 (2025-08-14) and Windows 10 LTSC 2021(2025-08-14) contains a…
CVE-2025-43193 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.6, macOS Sonoma 14.7.7,…
CVE-2025-24269 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4. An app may be able to…
CVE-2025-24264 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in Safari 18.4, iOS 18.4 and iPadOS 18.4,…
CVE-2025-24260 — Critical (CVSS 9.8): The issue was addressed with improved memory handling. This issue is fixed in macOS Sequoia 15.4, macOS Sonoma 14.7.5,…

Browse all CWE-400 (Uncontrolled Resource Consumption) vulnerabilities →